diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index 7bb90863d..035ed9091 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -39,7 +39,7 @@ class Callbacks(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) + name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( name="poolscanner", plugin=poolscanner.PoolScanner, version=(1, 0, 0) @@ -691,7 +691,7 @@ class Callbacks(interfaces.plugins.PluginInterface): ) collection = ssdt.SSDT.build_module_collection( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, self.config["kernel"] ) callback_methods = ( diff --git a/volatility3/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py index a1959453a..413ea782f 100644 --- a/volatility3/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -59,7 +59,7 @@ class DriverIrp(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) + name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) @@ -70,10 +70,8 @@ class DriverIrp(interfaces.plugins.PluginInterface): ] def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - collection = ssdt.SSDT.build_module_collection( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, self.config["kernel"] ) kernel_space_start = modules.Modules.get_kernel_space_start( diff --git a/volatility3/framework/plugins/windows/drivermodule.py b/volatility3/framework/plugins/windows/drivermodule.py index db1255637..c6547aae0 100644 --- a/volatility3/framework/plugins/windows/drivermodule.py +++ b/volatility3/framework/plugins/windows/drivermodule.py @@ -26,7 +26,7 @@ class DriverModule(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) + name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) @@ -42,10 +42,8 @@ class DriverModule(interfaces.plugins.PluginInterface): A common rootkit technique is to register drivers from modules that are hidden, which allows us to detect the disconnect between a malicious driver and its hidden module. """ - kernel = self.context.modules[self.config["kernel"]] - collection = ssdt.SSDT.build_module_collection( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, self.config["kernel"] ) kernel_space_start = modules.Modules.get_kernel_space_start( diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index 18e087553..98e5781ae 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -35,7 +35,7 @@ class Threads(thrdscan.ThrdScan): name="thrdscan", plugin=thrdscan.ThrdScan, version=(1, 1, 0) ), requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) + name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( name="modules", plugin=modules.Modules, version=(2, 1, 0) @@ -57,13 +57,7 @@ class Threads(thrdscan.ThrdScan): Returns: A generator of thread objects of orphaned threads """ - module = context.modules[module_name] - layer_name = module.layer_name - symbol_table_name = module.symbol_table_name - - collection = ssdt.SSDT.build_module_collection( - context, layer_name, symbol_table_name - ) + collection = ssdt.SSDT.build_module_collection(context, module_name) kernel_space_start = modules.Modules.get_kernel_space_start( context, module_name diff --git a/volatility3/framework/plugins/windows/registry/getcellroutine.py b/volatility3/framework/plugins/windows/registry/getcellroutine.py index 200a45a82..22374e205 100644 --- a/volatility3/framework/plugins/windows/registry/getcellroutine.py +++ b/volatility3/framework/plugins/windows/registry/getcellroutine.py @@ -31,15 +31,13 @@ class GetCellRoutine(interfaces.plugins.PluginInterface): name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) ), requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) + name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), ] def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - collection = ssdt.SSDT.build_module_collection( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, self.config["kernel"] ) # walk each hive and validate that the GetCellRoutine handler diff --git a/volatility3/framework/plugins/windows/timers.py b/volatility3/framework/plugins/windows/timers.py index cd8101a95..4bf574143 100644 --- a/volatility3/framework/plugins/windows/timers.py +++ b/volatility3/framework/plugins/windows/timers.py @@ -35,7 +35,7 @@ class Timers(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) + name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( name="kpcrs", plugin=kpcrs.KPCRs, version=(1, 0, 0) @@ -122,15 +122,18 @@ class Timers(interfaces.plugins.PluginInterface): def _generator(self) -> Iterator[Tuple]: kernel = self.context.modules[self.config["kernel"]] - layer_name = kernel.layer_name - symbol_table = kernel.symbol_table_name collection = ssdt.SSDT.build_module_collection( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, + self.config["kernel"], ) + # FIXME - the list_timers API is gross. Fix after GUI merge for timer in self.list_timers( - self.context, self.config["kernel"], layer_name, symbol_table + self.context, + self.config["kernel"], + kernel.layer_name, + kernel.symbol_table_name, ): if not timer.valid_type(): continue